GPT-6 Astra Hits Amazon Bedrock With 1M-Token Context and Critical Security Tier

GPT-6 Astra from OpenAI reached general availability on Amazon Bedrock on September 8, 2026, making it the first OpenAI model accessible through Amazon's managed inference infrastructure. Engineering teams running production workloads on Bedrock can now call GPT-6 Astra directly via the Amazon Bedrock APIs without standing up separate OpenAI API accounts or negotiating independent data-handling agreements. The model also slots into two purpose-built OpenAI agents — ChatGPT Work and Codex — when those are configured to route through Bedrock.

GPT-6 Astra is the first OpenAI model to reach the Critical classification for cybersecurity capability under OpenAI's Preparedness Framework. At that tier, automated classifiers monitor misuse in real time and can pause or terminate activity that crosses defined boundaries. That capability profile, combined with AWS's enterprise compliance surface, raises the architectural questions most relevant to teams deploying autonomous agents — questions examined in our analysis of infrastructure governance as the real unlock for safe agent deployment.

Context Window and Caching

The most immediately deployable specification is the context window: GPT-6 Astra accepts up to 1 million input tokens, large enough to ingest hundreds of pages in a single pass — the source explicitly cites contract review as a use case. At that scale, repeated full-context processing creates latency and cost problems, which is why prompt caching ships at two levels. Implicit caching handles context reuse automatically. Explicit caching lets engineers set cache breakpoints, designating which portions of a long context are frozen and reused across requests. For recurring workflows — document review pipelines, agents grounded in a fixed knowledge base, codebase analysis runs — explicit breakpoints reduce redundant computation on the portions of context that do not change between calls. This is a design decision that pays off at the pipeline architecture level, where repeated full-context reprocessing is one of the more avoidable throughput bottlenecks in production systems.

Security and Data Governance

Inference data is encrypted in transit and at rest. Zero-operator access is enforced at the chip level — AWS operators cannot access prompts or completions during inference. Every model invocation is logged in AWS CloudTrail, and traffic can be routed over VPC endpoints via AWS PrivateLink. Organization-level data perimeter policies can be applied to block exfiltration across account and network boundaries.

Inference data is not used for model training, and using GPT-6 Astra on Bedrock does not require opting into data sharing with OpenAI. The one exception is the automated abuse detection pathway: when classifiers flag traffic, AWS retains that flagged data for up to 30 days for programmatic review. Zero data retention is available on request through an AWS account team; it is not the default.

Deployment Surface

ChatGPT Work gains new enterprise plugins with this launch that extend browser-use capabilities to business intelligence tools, Workday, Navan, and Avalara. These plugins operate within the permissions administrators already establish and do not grant GPT-6 Astra access beyond what the user account already holds. Codex, when configured to use Bedrock, applies Astra's reasoning and computer-use capabilities across local files, repositories, terminals, and development environments. Access controls on ChatGPT Work let operators restrict which applications and websites the agent can reach, require confirmation before specified actions, and follow execution progress step by step — a meaningful control surface for teams that have learned that production AI failures surface at the architecture layer, not the model layer.

GPT-6 Astra's Critical cybersecurity classification arriving simultaneously with its enterprise cloud debut reflects an industry shift toward shipping capability tiers and safeguard tiers together rather than retrofitting governance after deployment. The combination of a 1-million-token context window, granular caching controls, and hardware-enforced data isolation is likely to set the baseline expectation for enterprise frontier model deployment going forward.